1. Describe the matter
Provide a brief non-sensitive summary, relevant dates, the email platform and what sources are available. Mention deadlines and whether legal advisers are involved. Do not send passwords, one-time codes, recovery keys or evidence with an initial enquiry.
2. Confirm authority and scope
Identify the instructing party and custodian. Address authority, conflicts, confidentiality, potentially privileged material and cross-border handling before collecting evidence. A feasibility stage may precede full examination. Scope, costs, assumptions and timetable are agreed in writing.
3. Preserve and examine
Document the collection method, settings, time, errors, exclusions and transformations. Keep source material identifiable. Examination tests the agreed questions using available records, with limitations and contrary evidence recorded.
4. Report and explain
Possible deliverables include a feasibility opinion, acquisition report, evidence schedule, chronology, technical examination report and agreed native exports. Expert reporting or testimony is separately instructed. Recovery, admissibility and litigation outcomes are not guaranteed.